Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
UAC-0063 (threat actor)
Risk
96
Critical
43 techniques 55 tools/malware 8 vulnerabilities 40 IOCs 6/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
1
T1583.003
Virtual Private Server resource development
›
3 Delivery
4
T1189
Drive-by Compromise initial access
T1190
Exploit Public-Facing Application initial access
T1566
Phishing initial access
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
20
T1053
Scheduled Task/Job execution
T1053.005
Scheduled Task execution
T1059
Command and Scripting Interpreter execution
T1059.003
Windows Command Shell execution
T1059.005
Visual Basic execution
T1106
Native API execution
T1203
Exploitation for Client Execution execution
T1204
User Execution execution
T1204.002
Malicious File execution
T1559
Inter-Process Communication execution
T1068
Exploitation for Privilege Escalation privilege escalation
T1548
Abuse Elevation Control Mechanism privilege escalation
CVE CVE-2016-4117
CVE CVE-2017-0199
CVE CVE-2018-4878
CVE CVE-2020-1380
CVE CVE-2020-26411
CVE CVE-2021-26411
CVE CVE-2022-38028
CVE CVE-2024-23692
›
5 Installation
8
T1003
OS Credential Dumping credential access
T1555
Credentials from Password Stores credential access
T1033
System Owner/User Discovery discovery
T1057
Process Discovery discovery
T1082
System Information Discovery discovery
T1087.001
Local Account discovery
T1120
Peripheral Device Discovery discovery
T1547
Boot or Logon Autostart Execution persistence
›
6 Command & Control
9
T1005
Data from Local System collection
T1113
Screen Capture collection
T1123
Audio Capture collection
T1071
Application Layer Protocol command and control
T1071.001
Web Protocols command and control
T1102
Web Service command and control
T1105
Ingress Tool Transfer command and control
T1573.001
Symmetric Cryptography command and control
T1573.002
Asymmetric Cryptography command and control
›
7 Actions on Objectives
9
T1529
System Shutdown/Reboot impact
T1561
Disk Wipe impact
T1561.001
Disk Content Wipe impact
T1027
Obfuscated Files or Information stealth
T1027.013
Encrypted/Encoded File stealth
T1036
Masquerading stealth
T1055
Process Injection stealth
T1218.005
Mshta stealth
T115?
T115?
Stage risk: Critical High Medium None

Tools & Malware (55)

Akira AndroRAT Authentic Antics Authentic Antics ransomware Backdoors BlackByte CHERRYSPY CHERRYSPY (DownEx/DownExPyer) Carbanak Cobalt Cobalt Strike beacon CrimsonRAT Custom malware DLL Backdoor Blitz DealersChoice DownEx Global Globe HATVIBE Indrik Spider Kimsuky LOGPIE keylogger Lyceum MuddyWater Naikon Nexus OilRig OneDrive Payload Payload Phishing emails PyPlunderPlug USB exfiltration tool Python-based implant framework Rejetto HTTP File Server RoundCube Sednit Seduploader ShadowPad Sofacy Sofacy Exploit Platform Spear-phishing Systeminfo Turla Unknown VBScript Void Windows Command Shell Winnti Zebrocy attrib mshta mshta loader (HTA) mshta.exe phishing pyplunderplug

Indicators of Compromise (40)

Domain
config.ini lanmangraphics.com findcolor.py rss-feed-monitoring.com underwearshopfor.com futuresfurnitures.com automation-embedding.com tieringservice.com +8 more
Filename
AccessProtection.hta pythonw.exe certstorecheck.hta mshta.exe 379.zip
MD5 Hash
3cf8f57bd07fdd8e06b1630a3f27f330 bd7d98bc785beff4f4e5f7d8fc1ac2b4 da6d60f86a6c38127260e29fa91c1c8a 2e91803687463201792ca7514fca07fa b657d46d69e24b3607a81cacc486e384 8f7dab01610b53398a296192ee600905 363f000702504ab19652dde2fde800e8 c3288a9d7fe494ae85a70af9f84e4d02
IPv4 Address
91.237.124.142 38.180.87.154 84.32.188.23 185.158.248.198 185.62.56.47 109.230.199.99 212.224.86.69 185.167.63.42 +3 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

34 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Weaponization (1)
M1056 Pre-compromise
Delivery (15)
M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more
Exploitation (21)
M1013 Application Developer Guidance M1017 User Training M1018 User Account Management M1019 Threat Intelligence Program M1021 Restrict Web-Based Content +16 more
Installation (10)
M1015 Active Directory Configuration M1017 User Training M1025 Privileged Process Integrity M1026 Privileged Account Management M1027 Password Policies +5 more
Command & Control (5)
M1020 SSL/TLS Inspection M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1057 Data Loss Prevention
Actions on Objectives (11)
M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1038 Execution Prevention +6 more

Detection Coverage

42 strategies
6/7 stages covered

Weaponization (1)

DET0838 Detection of Virtual Private Server

Delivery (4)

DET0070 Detection Strategy for Phishing across p... DET0080 Exploit Public-Facing Application – mult... DET0176 Drive-by Compromise — Behavior-based, Mu... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (12)

DET0076 Behavioral Detection of Visual Basic Exe... DET0094 Cross-Platform Behavioral Detection of S... DET0202 Behavioral Detection of Windows Command... DET0287 Exploitation for Client Execution – cros... DET0294 User Execution – Malicious File via down... +7 more

Installation (8)

DET0034 Detection of Adversarial Process Discove... DET0093 Behavioral Detection of User Discovery v... DET0234 Credential Dumping via Sensitive Memory... DET0274 Boot or Logon Autostart Execution Detect... DET0303 Local Account Enumeration Across Host Pl... +3 more

Command & Control (9)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0143 Detection Strategy for Encrypted Channel... DET0221 Behavioral Detection Strategy for T1123... DET0346 Detect Screen Capture via Commands and A... +4 more

Actions on Objectives (8)

DET0087 Encrypted or Encoded File Payload Detect... DET0127 Behavioral Detection of Masquerading Acr... DET0137 Detection Strategy for Disk Wipe via Dir... DET0316 Detection Strategy for Disk Content Wipe... DET0378 Behavioral Detection of Obfuscated Files... +3 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

UAC-0063

Type: Unknown Active
APT28 TAG-110 including government entities diplomatic missions CHERRYSPY +52 more
Infrastructure 27 IOC(s)
50%
Domain
config.ini lanmangraphics.com findcolor.py rss-feed-monitoring.com underwearshopfor.com +11
IPv4 Address
91.237.124.142 38.180.87.154 84.32.188.23 185.158.248.198 185.62.56.47 +6
Artifacts (13)
AccessProtection.hta pythonw.exe certstorecheck.hta mshta.exe 379.zip 3cf8f57bd07fdd8e06b1630a3f27f330 +7
Capability
50%
43 technique(s) 55 tool(s)/malware 8 CVE(s)
Akira AndroRAT Authentic Antics Authentic Antics ransomware Backdoors BlackByte CHERRYSPY CHERRYSPY (DownEx/DownExPyer) +47
T115?
collection
T1005 T1113 T1123
command and control
T1071 T1071.001 T1102 T1105 +2
credential access
T1003 T1555
Victim
70%

Targeted Sectors

government defense telecommunications financial-services education non-profit healthcare energy manufacturing media think-tank critical-infrastructure aviation aerospace pharmaceutical hospitality chemical transportation information-technology retail maritime legal-services oil-gas mining gaming nuclear entertainment utilities construction

Targeted Countries

RU US CN UA KZ IL DE AE GB IN VN RO PK IR JP KR BY TW SA NL PL TR AU LB FR SG IT MX ES KP CA IQ NG AZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1583.003

Capability (Malware)

Akira AndroRAT Authentic Antics
3 Delivery

Capability (Malware)

Akira AndroRAT Authentic Antics
4 Exploitation

Capability (Malware)

Akira AndroRAT Authentic Antics
5 Installation

Capability (Malware)

Akira AndroRAT Authentic Antics
6 Command & Control

Capability (Malware)

Akira AndroRAT Authentic Antics
7 Actions on Objectives

Capability (Techniques)

T1529 T1561 T1561.001

Capability (Malware)

Akira AndroRAT Authentic Antics
Leaving Threaticon

This link opens an external site that isn't part of the platform.